Re: Dazed and confused ...
Having now googled it, she really ought to pursue this case under the DPA.
Guidance is at https://ico.org.uk/media/for-organisations/documents/1542/cctv-code-of-practice.pdf and clearly suggests this is in violation of the rules.
For instance, the signage should tell the public that they are being monitored, and for what purpose. If the lift said "for the purpose of crime prevention" then selling footage to C4 is clearly not that. There are many, many other rules broken here though.